Samba Command Injection Vulnerability (CVE-2025-10230)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:samba:samba";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.155661");
  script_version("2025-11-10T05:40:50+0000");
  script_tag(name:"last_modification", value:"2025-11-10 05:40:50 +0000 (Mon, 10 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-10-16 03:04:58 +0000 (Thu, 16 Oct 2025)");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-11-07 20:15:35 +0000 (Fri, 07 Nov 2025)");

  script_cve_id("CVE-2025-10230");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Samba Command Injection Vulnerability (CVE-2025-10230)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("smb_nativelanman.nasl", "gb_samba_detect.nasl");
  script_mandatory_keys("samba/smb_or_ssh/detected");

  script_tag(name:"summary", value:"Samba is prone to a command injection vulnerability via WINS
  server hook script.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"If a Samba server has WINS support enabled (it is off by
  default), and it has a 'wins hook' parameter specified, the program specified by that parameter
  will be run whenever a WINS name is changed.

  The WINS server used by the Samba Active Directory Domain Controller did not validate the names
  passed to the wins hook program, and it passed them by inserting them into a string run by a
  shell.

  WINS is an obsolete and trusting protocol, and clients can request any name that fits within the
  15 character NetBIOS limit. This includes some shell metacharacters, making it possible to run
  arbitrary commands on the host.

  The WINS server used by Samba when it is not a domain controller is unaffected.");

  script_tag(name:"affected", value:"Samba version 4.x prior to 4.21.9, 4.22.x prior to 4.22.5 and
  4.23.x prior to 4.23.2.");

  script_tag(name:"solution", value:"Update to version 4.21.9, 4.22.5, 4.23.2 or later.");

  script_xref(name:"URL", value:"https://www.samba.org/samba/security/CVE-2025-10230.html");
  script_xref(name:"URL", value:"https://www.samba.org/samba/history/samba-4.21.9.html");
  script_xref(name:"URL", value:"https://www.samba.org/samba/history/samba-4.22.5.html");
  script_xref(name:"URL", value:"https://www.samba.org/samba/history/samba-4.23.2.html");
  script_xref(name:"URL", value:"https://lists.samba.org/archive/samba-announce/2025/000704.html");
  script_xref(name:"URL", value:"https://github.com/dptsec/CVE-2025-10230");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range_exclusive(version: version, test_version_lo: "4.0", test_version_up: "4.21.9")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.21.9", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "4.22.0", test_version_up: "4.22.5")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.22.5", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "4.23.0", test_version_up: "4.23.2")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.23.2", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);